Skip to content
Threat Feed
Subscribe

Product

Payload (>= 3.0.0 < 3.90.0, >= 4.0.0-Canary.0 < 4.0.0-Canary.34)

1 brief RSS
critical advisory

Payload API Key Disclosure via Document Read Access

A vulnerability in Payload CMS versions 3.x and 4.x-canary allows unauthorized users with document read permissions to access active API keys stored within authentication collections.

payload +12 information-disclosure cms authentication web-application cve-2026-105847 web-vulnerability access-control sqli +12
9t 1c updated